Separ - Multi-Tenant Authorization Platform

سپر (Separ - "Shield" in Persian)

A highly secure, multi-tenant authorization platform built on SpiceDB and Google Zanzibar principles.

Features • Quick Start • Architecture • API Reference • Contributing

🎯 Features

Feature	Description
Multi-Tenant Architecture	Support for 1000+ applications and services with complete isolation
SpiceDB Integration	Google Zanzibar-style relationship-based access control (ReBAC)
OAuth/SSO Support	Microsoft Entra ID, Google, Okta, and custom OIDC providers
Federated Identity Sync	Sync customer IdPs with central authorization via SCIM/webhooks
PostgreSQL Backend	Reliable metadata storage with full audit logging
Rust Implementation	Memory-safe, high-performance, low-latency authorization checks
Modular Identity Providers	Pluggable provider architecture for Azure AD, Okta, Google, LDAP
Proxy Mode	PostgreSQL wire protocol proxy for transparent authorization

🏗️ Architecture

┌─────────────────────────────────────────────────────────────────────────────────┐ │ CUSTOMER COMPANIES │ └─────────────────────────────────────────────────────────────────────────────────┘ ┌──────────────────────┐ ┌──────────────────────┐ ┌──────────────────────┐ │ Company A │ │ Company B │ │ Company C │ │ ┌────────────┐ │ │ ┌────────────┐ │ │ ┌────────────┐ │ │ │ Their IdP │ │ │ │ Their IdP │ │ │ │ Their IdP │ │ │ │ (Okta) │ │ │ │ (Entra ID) │ │ │ │ (Google) │ │ │ └─────┬──────┘ │ │ └─────┬──────┘ │ │ └─────┬──────┘ │ │ │ │ │ │ │ │ │ │ │ ┌─────▼──────┐ │ │ ┌─────▼──────┐ │ │ ┌─────▼──────┐ │ │ │ Their Apps │ │ │ │ Their Apps │ │ │ │ Their Apps │ │ │ │ - App 1 │ │ │ │ - App X │ │ │ │ - App Y │ │ │ │ - App 2 │ │ │ │ - App Z │ │ │ │ - App W │ │ │ └─────┬──────┘ │ │ └─────┬──────┘ │ │ └─────┬──────┘ │ └─────────┼────────────┘ └─────────┼────────────┘ └─────────┼────────────┘ │ │ │ │ SCIM/Webhook │ SCIM/Webhook │ SCIM/Webhook │ Sync Events │ Sync Events │ Sync Events ▼ ▼ ▼ ┌─────────────────────────────────────────────────────────────────────────────────┐ │ SEPAR AUTHORIZATION PLATFORM │ │ ┌────────────────────────────────────────────────────────────────────────────┐ │ │ │ Sync Gateway Layer │ │ │ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ │ │ SCIM API │ │ Webhook │ │ Event │ │ Batch │ │ │ │ │ │ Endpoints │ │ Receivers │ │ Processors │ │ Importers │ │ │ │ │ └─────────────┘ └─────────────┘ └─────────────┘ └─────────────┘ │ │ │ └────────────────────────────────────┬───────────────────────────────────────┘ │ │ │ │ │ ┌────────────────────────────────────▼───────────────────────────────────────┐ │ │ │ Central Authorization Service │ │ │ │ ┌─────────────────────┐ ┌─────────────────────┐ ┌─────────────────────┐ │ │ │ │ │ Tenant Manager │ │ Permission Checker │ │ Relationship │ │ │ │ │ │ - Company Registry │ │ - Check API │ │ Manager │ │ │ │ │ │ - App Registry │ │ - LookupSubjects │ │ - Write Tuples │ │ │ │ │ │ - User Mapping │ │ - LookupResources │ │ - Delete Tuples │ │ │ │ │ └─────────────────────┘ └─────────────────────┘ └─────────────────────┘ │ │ │ └────────────────────────────────────┬───────────────────────────────────────┘ │ │ │ │ │ ┌────────────────────────────────────▼───────────────────────────────────────┐ │ │ │ Data Layer │ │ │ │ ┌─────────────────────────────────┐ ┌─────────────────────────────────┐ │ │ │ │ │ SpiceDB Cluster │ │ PostgreSQL │ │ │ │ │ │ - Relationships │ │ - Tenant Metadata │ │ │ │ │ │ - Permissions │ │ - Audit Logs │ │ │ │ │ │ - Schema │ │ - OAuth Configs │ │ │ │ │ │ - Caveats │ │ - Sync State │ │ │ │ │ └─────────────────────────────────┘ └─────────────────────────────────┘ │ │ │ └────────────────────────────────────────────────────────────────────────────┘ │ └─────────────────────────────────────────────────────────────────────────────────┘

📦 Crates

Crate	Description
`separ-core`	Core types, traits, and domain models
`separ-spicedb`	SpiceDB client and schema management
`separ-db`	PostgreSQL models and migrations
`separ-sync`	Tenant sync service (SCIM, webhooks)
`separ-oauth`	OAuth/OIDC provider integration
`separ-identity`	Modular identity provider implementations
`separ-proxy`	PostgreSQL wire protocol proxy
`separ-api`	API handlers and middleware
`separ-server`	Main server binary

🚀 Quick Start

Prerequisites

Rust 1.75+
Docker & Docker Compose
PostgreSQL 15+
SpiceDB

Option 1: Docker Compose (Recommended)

# Clone the repository git clone https://github.com/Angelerator/Separ.git cd Separ # Start all services docker-compose up -d # Check health curl http://localhost:8080/health

Option 2: Development Setup

# Start infrastructure only docker-compose up -d postgres spicedb # Run database migrations docker exec -i separ-postgres psql -U separ -d separ < crates/separ-db/migrations/20250101000001_initial_schema.sql # Build and run the server cargo run -p separ-server

The server will be available at http://localhost:8080.

Configuration

Configuration is managed via config/default.toml:

[server] host = "0.0.0.0" port = 8080 [database] url = "postgres://separ:separ@localhost:5433/separ" [spicedb] endpoint = "http://localhost:50051" token = "supersecretkey" [jwt] secret = "your-jwt-secret-here"

Note: Docker Compose maps PostgreSQL to port 5433 to avoid conflicts with local installations.

⚠️ Security Warning: The default credentials are for development only. In production:

Generate a strong SpiceDB preshared key (min 32 characters)

Use strong PostgreSQL credentials

Set a secure JWT_SECRET

Enable TLS for all connections

🔐 SpiceDB Schema

The platform uses a hierarchical permission model:

definition platform { relation admin: user } definition tenant { relation platform: platform relation owner: user relation admin: user relation member: user permission manage = owner + admin + platform->admin permission view = manage + member } definition workspace { relation tenant: tenant relation owner: user relation admin: user relation member: user permission manage = owner + admin + tenant->admin permission view = manage + member } definition application { relation workspace: workspace relation owner: user relation admin: user relation user: user permission manage = owner + admin + workspace->admin permission use = manage + user + workspace->member } definition resource { relation application: application relation owner: user relation editor: user relation viewer: user permission manage = owner + application->admin permission edit = manage + editor permission view = edit + viewer + application->user }

📡 API Endpoints

Health & Metrics

Method	Endpoint	Description
`GET`	`/health`	Health check
`GET`	`/metrics`	Prometheus metrics

Tenant Management

Method	Endpoint	Description
`POST`	`/api/v1/tenants`	Create tenant
`GET`	`/api/v1/tenants`	List tenants
`GET`	`/api/v1/tenants/{id}`	Get tenant
`PUT`	`/api/v1/tenants/{id}`	Update tenant
`DELETE`	`/api/v1/tenants/{id}`	Delete tenant

Authorization

Method	Endpoint	Description
`POST`	`/api/v1/authz/check`	Check permission
`GET`	`/api/v1/authz/relationships`	Browse relationships (requires `resource_type`)
`POST`	`/api/v1/authz/relationships`	Write relationship
`DELETE`	`/api/v1/authz/relationships`	Delete relationships
`POST`	`/api/v1/authz/lookup/subjects`	Lookup subjects with permission
`POST`	`/api/v1/authz/lookup/resources`	Lookup accessible resources

OAuth/SSO

Method	Endpoint	Description
`GET`	`/api/v1/oauth/{provider}/login`	Initiate OAuth flow
`GET`	`/api/v1/oauth/{provider}/callback`	OAuth callback

Identity Sync

Method	Endpoint	Description
`POST`	`/api/v1/sync/webhook`	Handle IdP webhooks
`POST`	`/api/v1/identity/providers`	Register identity provider
`GET`	`/api/v1/identity/providers`	List identity providers

🧪 Testing

Run All Tests

# Unit tests cargo test --workspace # With integration tests (requires Docker services) docker-compose up -d cargo test --workspace -- --include-ignored

Quick API Test

# Create a tenant curl -X POST http://localhost:8080/api/v1/tenants \ -H "Content-Type: application/json" \ -d '{"name": "Acme Corp", "slug": "acme"}' # Add owner permission curl -X POST http://localhost:8080/api/v1/authz/relationships \ -H "Content-Type: application/json" \ -d '{  "resource_type": "tenant",  "resource_id": "<TENANT_ID>",  "relation": "owner",  "subject_type": "user",  "subject_id": "alice"  }' # Check permission curl -X POST http://localhost:8080/api/v1/authz/check \ -H "Content-Type: application/json" \ -d '{  "resource_type": "tenant",  "resource_id": "<TENANT_ID>",  "permission": "manage",  "subject_type": "user",  "subject_id": "alice"  }' # Browse relationships curl "http://localhost:8080/api/v1/authz/relationships?resource_type=tenant" | jq .

🔍 Using Zed CLI

AuthZed's official CLI for managing SpiceDB:

# Install brew install authzed/tap/zed # Configure context zed context set separ "localhost:50051" "supersecretkey" --insecure # View schema zed schema read --insecure # Read relationships zed relationship read tenant --insecure # Check permission zed permission check tenant:<TENANT_ID> manage user:alice --insecure

🚢 Deployment

Docker

# Build image docker build -t separ:latest . # Run with environment variables docker run -d \ -p 8080:8080 \ -e DATABASE_URL="postgres://user:pass@host/db" \ -e SPICEDB_ENDPOINT="http://spicedb:50051" \ -e SPICEDB_TOKEN="your-secure-token" \ separ:latest

Releasing

Releases are automated via GitHub Actions. To create a release:

# Tag a release git tag v1.0.0 git push origin v1.0.0

This triggers:

Cross-platform builds (Linux x86_64/musl, macOS x86_64/arm64)
Docker multi-arch image push to GHCR
GitHub Release with artifacts and checksums

🛡️ Security

Authentication: JWT, API Keys, Service Tokens, mTLS
Authorization: SpiceDB-based relationship authorization
Audit Logging: Complete audit trail in PostgreSQL
Rate Limiting: Configurable per-endpoint limits
TLS: Full TLS support for all connections

Reporting Vulnerabilities

Please report security vulnerabilities via GitHub Security Advisories.

🤝 Contributing

Fork the repository
Create a feature branch (git checkout -b feature/amazing)
Commit changes (git commit -m 'Add amazing feature')
Push to branch (git push origin feature/amazing)
Open a Pull Request

Development Guidelines

Run cargo fmt before committing
Ensure cargo clippy passes without warnings
Add tests for new functionality
Update documentation as needed

📄 License

Apache-2.0 - See LICENSE for details.

Made with ❤️ by Angelerator

Name		Name	Last commit message	Last commit date
Latest commit History 75 Commits
.github/workflows		.github/workflows
config		config
crates		crates
helm/separ		helm/separ
scripts		scripts
spicedb		spicedb
tests		tests
.env.example		.env.example
.gitignore		.gitignore
Cargo.lock		Cargo.lock
Cargo.toml		Cargo.toml
Dockerfile		Dockerfile
IMPLEMENTATION_PLAN.md		IMPLEMENTATION_PLAN.md
README.md		README.md
docker-compose.yml		docker-compose.yml

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

Separ - Multi-Tenant Authorization Platform

🎯 Features

🏗️ Architecture

📦 Crates

🚀 Quick Start

Prerequisites

Option 1: Docker Compose (Recommended)

Option 2: Development Setup

Configuration

🔐 SpiceDB Schema

📡 API Endpoints

Health & Metrics

Tenant Management

Authorization

OAuth/SSO

Identity Sync

🧪 Testing

Run All Tests

Quick API Test

🔍 Using Zed CLI

🚢 Deployment

Docker

Releasing

🛡️ Security

Reporting Vulnerabilities

🤝 Contributing

Development Guidelines

📄 License

About

Uh oh!

Releases 9

Packages

Uh oh!

Contributors

Uh oh!

Languages

Folders and files

Latest commit

History

Repository files navigation

Separ - Multi-Tenant Authorization Platform

🎯 Features

🏗️ Architecture

📦 Crates

🚀 Quick Start

Prerequisites

Option 1: Docker Compose (Recommended)

Option 2: Development Setup

Configuration

🔐 SpiceDB Schema

📡 API Endpoints

Health & Metrics

Tenant Management

Authorization

OAuth/SSO

Identity Sync

🧪 Testing

Run All Tests

Quick API Test

🔍 Using Zed CLI

🚢 Deployment

Docker

Releasing

🛡️ Security

Reporting Vulnerabilities

🤝 Contributing

Development Guidelines

📄 License

About

Resources

Uh oh!

Stars

Watchers

Forks

Releases 9

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages